[#42311] [ruby-trunk - Feature #5958][Open] ThreadGroup#join — Masaki Matsushita <glass.saga@...>
12 messages
2012/02/01
[#42329] [RFC/PATCH] reinit signal_thread_list_lock atfork — Eric Wong <normalperson@...>
This issue was found under Ruby 1.9.3 (-p0 presumably), but probably
8 messages
2012/02/02
[#42331] Re: [RFC/PATCH] reinit signal_thread_list_lock atfork
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/02/02
> signal_thread_list_lock may be held in the timer thread during
[#42332] Re: [RFC/PATCH] reinit signal_thread_list_lock atfork
— Eric Wong <normalperson@...>
2012/02/02
KOSAKI Motohiro <[email protected]> wrote:
[#42333] Re: [RFC/PATCH] reinit signal_thread_list_lock atfork
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/02/02
2012/2/2 Eric Wong <[email protected]>:
[#42344] [ruby-trunk - Feature #5964][Open] Make Symbols an Alternate Syntax for Strings — Tom Wardrop <tom@...>
23 messages
2012/02/03
[#42355] [ruby-trunk - Feature #5964] Make Symbols an Alternate Syntax for Strings
— Kurt Stephens <redmine@...>
2012/02/05
[#42361] 1.9.3's 1st patch release — "NARUSE, Yui" <naruse@...>
Hi,
7 messages
2012/02/05
[#42391] I'll reject stalled feature tickets — Yusuke Endoh <mame@...>
(Japaneser later; 日本語は後で)
4 messages
2012/02/07
[#42404] [ruby-trunk - Bug #5978][Open] YAML.load_stream should process documents as they are read — Thomas Sawyer <transfire@...>
6 messages
2012/02/07
[#42442] [ruby-trunk - Bug #5978] YAML.load_stream should process documents as they are read
— Thomas Sawyer <transfire@...>
2012/02/08
[#42443] [ruby-trunk - Bug #5985][Open] miniruby skews "make benchmark" results — Eric Wong <normalperson@...>
21 messages
2012/02/08
[#50155] [ruby-trunk - Bug #5985] miniruby skews "make benchmark" results
— "ko1 (Koichi Sasada)" <redmine@...>
2012/11/26
[#50180] Re: [ruby-trunk - Bug #5985] miniruby skews "make benchmark" results
— Eric Wong <normalperson@...>
2012/11/26
"ko1 (Koichi Sasada)" <[email protected]> wrote:
[#59871] [ruby-trunk - Bug #5985] miniruby skews "make benchmark" results
— normalperson@...
2014/01/19
Issue #5985 has been updated by Eric Wong.
[#42444] [ruby-trunk - Bug #5986][Open] Segmentation Fault — Luis Matta <levmatta@...>
16 messages
2012/02/08
[#42448] [ruby-trunk - Bug #5988][Open] Time class interprets "2012-02-30" as "2012-03-01" — Dylan Markow <dmarkow@...>
5 messages
2012/02/08
[#42471] [ruby-trunk - Feature #5995][Open] calling io_advise_internal() in read_all() — Masaki Matsushita <glass.saga@...>
20 messages
2012/02/10
[#42480] [ruby-trunk - Feature #5999][Open] Optimize for faster loading time and win32/file.c refactoring — Hiroshi Shirosaki <h.shirosaki@...>
6 messages
2012/02/10
[#42500] Question on getting the receiver class information from a RUBY_EVENT_CALL event hook (1.9.2) — Daniel Cadenas <dcadenas@...>
Hi all, I hope someone can help me with this problem I'm having on a
3 messages
2012/02/11
[#42523] [ruby-trunk - Bug #6008][Open] {a: 1}.hash not consistent over VM restarts — Jens Berlips <jens@...>
6 messages
2012/02/13
[#42550] [ruby-trunk - Feature #1400] Please add a method to enumerate fields in OpenStruct — Yusuke Endoh <mame@...>
4 messages
2012/02/13
[#42554] Re: [ruby-trunk - Feature #1400] Please add a method to enumerate fields in OpenStruct
— Peter Vandenabeele <peter@...>
2012/02/13
On Mon, Feb 13, 2012 at 4:08 PM, Yusuke Endoh <[email protected]> wrote:
[#42564] some questions about nesting/constants — Xavier Noria <fxn@...>
Hello,
1 message
2012/02/13
[#42579] [ruby-trunk - Bug #6012][Open] Proc#source_location also return the column — Roger Pack <rogerpack2005@...>
14 messages
2012/02/14
[#42607] [ruby-trunk - Bug #6020][Open] Unexpected is_a/kind_of behaviour — Alex N <masterlambaster@...>
7 messages
2012/02/14
[#42613] [ruby-trunk - Bug #6021][Open] TestDBM#test_aref test fails — Vit Ondruch <v.ondruch@...>
9 messages
2012/02/14
[#42630] [ruby-trunk - Feature #6023][Open] Add "a ?= 2" support for meaning "a = a.nil? ? 2 : a" — Rodrigo Rosenfeld Rosas <rr.rosas@...>
7 messages
2012/02/14
[#42672] strange 1.9.3 GC issue with Nokogiri — Eric Wong <normalperson@...>
Hello ruby-core,
6 messages
2012/02/16
[#42704] Re: strange 1.9.3 GC issue with Nokogiri
— Tim Elliott <tle@...>
2012/02/17
On Wed, Feb 15, 2012 at 4:39 PM, Eric Wong <[email protected]> wrote:
[#42682] Ruby 1.9.3 patchlevel 125 released — "NARUSE, Yui" <naruse@...>
-----BEGIN PGP SIGNED MESSAGE-----
6 messages
2012/02/16
[#42686] Re: Ruby 1.9.3 patchlevel 125 released
— Jon <jon.forums@...>
2012/02/16
> Ruby 1.9.3-p125 is released.
[#42712] Re: Ruby 1.9.3 patchlevel 125 released
— Charles Oliver Nutter <headius@...>
2012/02/17
On Thu, Feb 16, 2012 at 11:19 AM, Jon <[email protected]> wrote:
[#42685] [ruby-trunk - Bug #6036][Open] Test failures in Fedora Rawhide/17 — Bohuslav Kabrda <bkabrda@...>
14 messages
2012/02/16
[#42697] [ruby-trunk - Bug #6040][Open] Transcoding test failure: Big5 to UTF8 not defined (MinGW) — Luis Lavena <luislavena@...>
10 messages
2012/02/16
[#42722] [ruby-trunk - Bug #6040] Transcoding test failure: Big5 to UTF8 not defined (MinGW)
— Yui NARUSE <naruse@...>
2012/02/17
[#42723] Re: [ruby-trunk - Bug #6040] Transcoding test failure: Big5 to UTF8 not defined (MinGW)
— Luis Lavena <luislavena@...>
2012/02/17
On Fri, Feb 17, 2012 at 7:47 PM, Yui NARUSE <[email protected]> wrote:
[#42715] Classes as pure mixin conatiners — trans <transfire@...>
Some time ago, I suggested that it might be worth considering a design
3 messages
2012/02/17
[#42755] [ruby-trunk - Bug #6048][Open] {Unbound}Method#hash doesn't always return the right value — Marc-Andre Lafortune <ruby-core@...>
5 messages
2012/02/20
[#42777] 500 reputation stackoverflow question about Ruby GIL — Grigory Petrov <grigory.v.p@...>
Hello.
5 messages
2012/02/21
[#42797] Re: 500 reputation stackoverflow question about Ruby GIL
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/02/22
2012/2/21 Grigory Petrov <[email protected]>:
[#42800] Re: 500 reputation stackoverflow question about Ruby GIL
— Grigory Petrov <grigory.v.p@...>
2012/02/22
No, it fails same way on all my OSX versions from 10.5 to 10.7
[#42789] [ruby-trunk - Bug #6057][Open] URI - Nonsensical Behavior — Scott Gonyea <scott@...>
9 messages
2012/02/22
[#42813] [ruby-trunk - Feature #6065][Open] Allow Bignum marshalling/unmarshalling from C API — Martin Bosslet <Martin.Bosslet@...>
22 messages
2012/02/23
[#42820] [ruby-trunk - Feature #6065] Allow Bignum marshalling/unmarshalling from C API
— Martin Bosslet <Martin.Bosslet@...>
2012/02/23
[#42869] [ruby-trunk - Feature #6065] Allow Bignum marshalling/unmarshalling from C API
— Martin Bosslet <Martin.Bosslet@...>
2012/02/24
[#42876] Re: [ruby-trunk - Feature #6065] Allow Bignum marshalling/unmarshalling from C API
— Yusuke Endoh <mame@...>
2012/02/25
Hello,
[#42843] [ruby-trunk - Feature #6070][Open] The scope of for loop variables — Shugo Maeda <redmine@...>
9 messages
2012/02/23
[#42857] [ruby-trunk - Feature #6074][Open] Allow alias arguments to have a comma — Thomas Sawyer <transfire@...>
20 messages
2012/02/24
[#42870] [ruby-trunk - Feature #6079][Open] Hash#each_sorted — Walter Urbaniak <mondgrav-ruby@...>
6 messages
2012/02/24
[#42891] [ruby-trunk - Feature #6083][Open] Hide a Bignum definition — Koichi Sasada <redmine@...>
23 messages
2012/02/25
[#48618] [ruby-trunk - Feature #6083] Hide a Bignum definition
— "matz (Yukihiro Matsumoto)" <matz@...>
2012/10/30
[#48640] Re: [ruby-trunk - Feature #6083] Hide a Bignum definition
— KOSAKI Motohiro <kosaki.motohiro@...>
2012/10/31
> Target version changed from 2.0.0 to next minor
[#42906] [ruby-trunk - Bug #6085][Open] Treatment of Wrong Number of Arguments — Marc-Andre Lafortune <ruby-core@...>
14 messages
2012/02/25
[#43253] [ruby-trunk - Bug #6085] Treatment of Wrong Number of Arguments
— Marc-Andre Lafortune <ruby-core@...>
2012/03/12
[#42972] 50$ for answering my stackoverflow question about Ruby GIL 500 reputation stackoverflow question about Ruby GIL 50$ for answering my stackoverflow question. — Grigory Petrov <grigory.v.p@...>
Hello.
3 messages
2012/02/27
[#42981] 50$ for answering my stackoverflow question about Ruby and GIL — Grigory Petrov <grigory.v.p@...>
Thanks.
7 messages
2012/02/27
[#42982] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Eric Hodel <[email protected]>
2012/02/27
On Feb 27, 2012, at 9:54 AM, Grigory Petrov wrote:
[#42983] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Grigory Petrov <grigory.v.p@...>
2012/02/27
I'm not so sure about that.
[#42985] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Eric Hodel <[email protected]>
2012/02/28
On Feb 27, 2012, at 12:10 PM, Grigory Petrov wrote:
[#42999] Re: 50$ for answering my stackoverflow question about Ruby and GIL
— Grigory Petrov <grigory.v.p@...>
2012/02/28
> This test code doesn't show switch time, it shows how fast two ruby threa=
[#42989] Re: [ruby-cvs:42007] nobu:r34829 (trunk): * ext/bigdecimal/bigdecimal.c (GetVpValueWithPrec): since methods — Eric Hodel <[email protected]>
On Feb 27, 2012, at 12:03 AM, [email protected] wrote:
4 messages
2012/02/28
[#43012] [ruby-trunk - Bug #6103][Open] Build failure on trunk 34850 with VC 2010 — Heesob Park <phasis@...>
5 messages
2012/02/29
[#43021] English instructions for setting up chkbuild? — Luis Lavena <luislavena@...>
Hello,
6 messages
2012/02/29
[#43030] return values of methods on String subclasses — Aaron Patterson <tenderlove@...>
It pains me to ask about this, but since Rails subclasses String, I need
10 messages
2012/02/29
[ruby-core:42432] [ruby-trunk - Bug #5353] TLS v1.0 and less - Attack on CBC mode
From:
Hiroshi Nakamura <nakahiro@...>
Date:
2012-02-08 06:10:52 UTC
List:
ruby-core #42432
Issue #5353 has been updated by Hiroshi Nakamura.
Backported to ruby_1_8 and ruby_1_8_7 by r34485 and r34486 respectively.
----------------------------------------
Bug #5353: TLS v1.0 and less - Attack on CBC mode
https://bugs.ruby-lang.org/issues/5353
Author: Martin Bosslet
Status: Open
Priority: High
Assignee:
Category: ext
Target version: 2.0.0
ruby -v: -
A well-known vulnerability of TLS v1.0 and earlier has recently gained some attention:
http://www.theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl/
Although this has been known for a long time (http://www.openssl.org/~bodo/tls-cbc.txt),
and a fix for this has been provided, in reality most applications seem to be working with
SSL_OP_ALL
which is a flag that enables some bug workarounds that were considered harmless.
We, too, use this in ossl_sslctx_s_alloc(VALUE klass) in ossl_ssl.c. Unfortunately,
this flag also includes
SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
which disables the fix for the "CBC vulnerability". Here is what a comment says
about the flag (OpenSSL 1.0.0d)
/* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added
* in OpenSSL 0.9.6d. Usually (depending on the application protocol)
* the workaround is not needed. Unfortunately some broken SSL/TLS
* implementations cannot handle it at all, which is why we include
* it in SSL_OP_ALL. */
If I understand http://www.openssl.org/~bodo/tls-cbc.txt correctly, the most
notable implementation that does not play well with these empty fragments
was (is?) IE - I don't know how this has evolved over time, I would have to
research further.
An easy fix for the situation would be to discard SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS,
but this would risk affecting existing installations.
What do you propose? Should we solve this before the 1.9.3 release?
(PS: The actual attack and fix are outlined in
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.61.5887&rep=rep1&type=pdf
The attack to be presented by Thai Duong and Juliano Rizzo at
http://ekoparty.org/cronograma.php (caution: currently the site is victim to the "reddit effect")
is very likely to be based on what was already known and should therefore hopefully
require no further fixes.)
--
http://bugs.ruby-lang.org/